octo | 290a0370e71bfb1a98d3353775e9729ce5dccf7c4498ce77f0e302808fba9e6c | Triage

Analysis

max time kernel
148s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01/10/2024, 22:01

Sharing

Report Analysis Logs

General

Target

290a0370e71bfb1a98d3353775e9729ce5dccf7c4498ce77f0e302808fba9e6c.apk
Size

2.2MB
MD5

e55598deed9f21ae32dddfe61b42bd53
SHA1

3f645b96142f78f87e3abd0f454021950342a67f
SHA256

290a0370e71bfb1a98d3353775e9729ce5dccf7c4498ce77f0e302808fba9e6c
SHA512

4442351b5f08a4c753f90e8626a26ce3471e176d3941181f54383e9c7d3ca743460e889299c96c999401e442dda0bbe8fef399c490af14f2ca71aba28542688e
SSDEEP

49152:IyTgiyYRjJ0uz8H+4YgSJ0mfOmKE1Of6G03c/p0ViRfNR0/U:ZhyujDz8H+4XS9rH1g6Nk0ViRFRIU

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat stealth trojan

Malware Config

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

rc4.plain

Extracted

Family

octo

C2

https://dijitaldunyayenifikirlervegirisim.xyz/YjdkMWRjNTllNzZi/

https://teknolojininileriyeniliklerrehberi.xyz/YjdkMWRjNTllNzZi/

https://sanatvedogaltasarimlarincografyasi.xyz/YjdkMWRjNTllNzZi/

https://kulturvesanatprojelerindogalteknikler.xyz/YjdkMWRjNTllNzZi/

https://fotografvesanatgozlemlerinesinlen.xyz/YjdkMWRjNTllNzZi/

https://yemektariflerivedogalurunlerkulubu.xyz/YjdkMWRjNTllNzZi/

https://gezginlericinyenirotalarvetavsiyeler.xyz/YjdkMWRjNTllNzZi/

https://sporseverlericinyeniharaketlerrehberi.xyz/YjdkMWRjNTllNzZi/

https://bilimveteknolojionerileridunyasi.xyz/YjdkMWRjNTllNzZi/

https://egitimvegirisimcilikdunyasindan.xyz/YjdkMWRjNTllNzZi/

https://sanatveguncelprojelerplani.xyz/YjdkMWRjNTllNzZi/

https://dijitaloyunvegirisimcilikakademisi.xyz/YjdkMWRjNTllNzZi/

https://dogalhayatvetatilrehberiniz.xyz/YjdkMWRjNTllNzZi/

https://kisiselgelisimvesosyalmedyayonetimi.xyz/YjdkMWRjNTllNzZi/

https://yasamvedogalyontemlerklavuzu.xyz/YjdkMWRjNTllNzZi/

https://kitapvedijitalokumakulubu.xyz/YjdkMWRjNTllNzZi/

https://sinemavetelevizyonprojelerigozlemi.xyz/YjdkMWRjNTllNzZi/

https://oyunvegencgirisimcilergelisim.xyz/YjdkMWRjNTllNzZi/

https://fotografvegundelikgozlemplatformu.xyz/YjdkMWRjNTllNzZi/

https://yeniseyahatvedogalgeziler.xyz/YjdkMWRjNTllNzZi/

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo

Octo payload 2 IoCs

resource	yara_rule
behavioral1/memory/4275-0.dex	family_octo
behavioral1/memory/4250-0.dex	family_octo

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

pid	Process
4250	com.follow.trial

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.follow.trial/app_ice/xE.json	4275	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.follow.trial/app_ice/xE.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.follow.trial/app_ice/oat/x86/xE.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.follow.trial/app_ice/xE.json	4250	com.follow.trial

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

Screen Capture

Keylogging

GUI Input Capture

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.follow.trial
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.follow.trial

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.follow.trial

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.follow.trial

Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

Application may abuse the accessibility service to prevent their removal.

Prevent Application Removal

ioc	Process
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.follow.trial
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.follow.trial
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.follow.trial
android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction	com.follow.trial

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.follow.trial

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs

collection credential_access

Access Notifications

description	ioc	Process
Intent action	android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS	com.follow.trial

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

User Evasion

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	com.follow.trial

Requests modifying system settings. 1 IoCs

description	ioc	Process
Intent action	android.settings.action.MANAGE_WRITE_SETTINGS	com.follow.trial

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.follow.trial

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.follow.trial

com.follow.trial
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Performs UI accessibility actions on behalf of the user
- Queries the mobile country code (MCC)
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Requests modifying system settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4250
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.follow.trial/app_ice/xE.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.follow.trial/app_ice/oat/x86/xE.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4275

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Foreground Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Foreground Persistence

Hide Artifacts

Suppress Application Icon

User Evasion

Impair Defenses

Prevent Application Removal

Input Injection

Credential Access

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Discovery

Software Discovery

Security Software Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Access Notifications

Input Capture

GUI Input Capture

Keylogging

Screen Capture

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Input Injection

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.follow.trial/app_ice/xE.json

Filesize
153KB

MD5
3280903c96e56198c5e9dc71dd283488

SHA1
c06473240b3421392ac4726ec58fb13cbf3faf1d

SHA256
c9138e7939a4cdd6f4c6e81b5ca2b705a5732374758a0fc56e30fc15026f5008

SHA512
fc17a1d0a47206b8e8cfb5f54903db8b40c41df17911f6e7ed425f3dcc808d541addde7bea60c96a8391818db9937cb2aacd01a81f58dd052dc785c6d996867b

Download Submit
/data/data/com.follow.trial/app_ice/xE.json

Filesize
153KB

MD5
07e1257d896efcd6f8a4b005b1908e0a

SHA1
142453f98ff31adc1ad74215edfcf39b0c6f1f79

SHA256
91bcf03589cff55fffcec4c6f8fcf38394b2a2481902b4dd3108c44b0f508e09

SHA512
4dcaacdc7f372857c316fb41c8f45292361b2622fb1e95dca91cdd78405e30074c140c0b9bc08b464bb613e49aa12b94a978ba3b4379c12e1d59104fa13df466

Download Submit
/data/user/0/com.follow.trial/app_ice/xE.json

Filesize
451KB

MD5
de3d124d7f41943f04c72a10a427db16

SHA1
a13f6db62175992c55baf58f2748569cb31331ce

SHA256
305fa94aa4bc0c34d62fcf122b90495734e469c228211272c02b192fce6515d3

SHA512
8ffd5af92358c6bbfec513451abb155d191bb5fd7e598e7e209fc198441174ebdb6110d117b1ab93fbdc606e197ee05fdb4da8cfec0427ef54ad867cd8dc3425

Download Submit
/data/user/0/com.follow.trial/app_ice/xE.json

Filesize
451KB

MD5
fdad001f53900c84a8e79e46e6611969

SHA1
3f962437a4938bb1ea0663d6d5c46aa3beb668e6

SHA256
382bbfbc461c93fdd76f5539ae7848d95bc51751e6f6848d947f11e2b700ffde

SHA512
faebe5ff59427fabcbd3ea8acff633fcaaa40cce048b7b4b0f36ad5586557f2ad035211bd68a91f9ab45737a53060ebc76f5b0ffb43e4fea591b19853ac5d014

Download Submit